JP2001517878A - Method and computer program product for classifying network communication packets processed in a network stack - Google Patents

Abstract

A method and computer program product for classifying network communication packets being processed in a network stack. The computer program product is a centralized packet classifier that receives classification requests from drivers or other clients according to a defined interface. This reduces the cost for producing a driver since less code is required initially at development time as well as a corresponding reduction in maintenance costs. The present invention groups drivers or other clients that utilize a certain body of classification information into classification families. Further, reference patterns used to make classifications are stored in separate databases depending on whether they are specific or general. There exists a single specific pattern database for all specific reference patterns regardless of classification family having a constant search time and a general pattern database for each general reference pattern for each classification family defined to the system whose search time may vary according to the amount of information contained therein. When servicing a classification request, the packet classifier will first search the specific pattern database followed by a search in the appropriate general pattern database if necessary.

Description

DETAILED DESCRIPTION OF THE INVENTION

BACKGROUND OF THE INVENTION FIELD OF THE INVENTION The present invention relates to the classification of network communication packets processed in a network stack. More specifically, the present invention relates to a generalized packet classifier that can be used to classify network communication packets from different software components, such as drivers, each with a different purpose for performing the classification. classifier). 2. BACKGROUND OF THE INVENTION With the current state of the art, the usefulness and benefits of stand-alone computing devices, such as ubiquitous personal computers, have been enhanced by the fact that many such computing devices can communicate with each other through communication networks. Was. With network communication between computers, there can be many different types of applications. Otherwise, these are not possible with a single computer device. One more common and useful application is simple messaging, which is used by many people to communicate by e-mail, also known as e-mail.

[0002] To communicate over a network, information to be conveyed between computers is divided into a number of network communication packets. These network communication packets (also known simply as "packets") eventually carry through the physical communication network. In the PC environment, it is the network interface card that resides in the personal computer that handles the transmission.
Although a PC environment is assumed throughout this application, the discussion and application of that concept also applies to many different network computing environments, as those skilled in the art will appreciate.

Information generated in an application program running on a PC is packetized into network communication packets by passing through various software components, and then reaches a network interface card for physical communication. Send over the network. The software components are typically hierarchical drivers, suitably interconnected, forming what is known as a network stack.

[0004] Each driver or other processing component processes data continuously,
The original data is broken down into successively different packetization schemes, the data is formed into packets, and the network stack is descended from one level to the next until it is transmitted over the network interface. The term "network communication packet" shall refer to any data packet used in a network protocol stack, regardless of the actual format. As the original data passes through the driver layer, it is packetized and formatted one after another. For example, the TCP layer encapsulates data in TCP packet units. Each of them may also be fragmented into multiple IP packets by the IP layer.

Typically, each driver has a specific function specified by a protocol or other constraint. For example, one driver can manage a network protocol, such as Internet Protocol (IP), and another driver can manage the actual network interface card.
Such a modality allows a variety of different user configurations to be created without rewriting the code. For example,
Network protocols can disassociate from any particular physical transmission system. In other words, by using interconnected drivers in the network stack, it is also possible to use the same network protocol driver with various physical interface drivers according to the specific physical configuration.

To send an e-mail message from one computer to another, the text of the information, along with some packet header information, is placed in higher level protocol packets and passed from the application to the network stack. . Each element of the network stack adds additional header information and makes processing decisions based on information in the packet itself or based on either previously created header information by a higher level driver. Can be. Further, packets at one level of the network stack can be broken down or reassembled into multiple packets at another level of the network stack. Eventually, all data will be packetized into packets suitable for transmission over the network interface.

Sending an e-mail message can be thought of as sending a letter by regular mail. The body of the message itself is created by the user in each case. There are a number of processing steps to send a letter by regular mail, followed by protection of the postal service (similar to sending a packet over a communication network). You have to get the envelope, write the address on the envelope, and stamp it before posting the letter to the post. Each intermediate step can be thought of as header information (address entry, envelope, etc.) that individual drivers create by processing email messages for distribution by network communication between computers.

At the receiving end, the packet is passed to the network stack. Each element of the network stack removes some of the header information and can make processing decisions based either on the packet itself or on header information not removed by lower level drivers. In addition, multiple packets at one level of the network stack can be combined into packet aggregations at another level of the network stack.

FIG. 1 shows an example of a network stack, with an application program 20 at the top and a number of drivers at each successive level until reaching the network interface card 22. That is, there are a driver A24, a driver B26, a driver C28, and a driver D30. Each driver performs processing associated with the packet, and then passes the packet to the next driver.

A packet is “classified” for some processing at a given driver based on information about the packet included in the header, information in the data portion of the packet itself. Based on the classification, the packet is subjected to different processing by the driver. As shown in FIG. 1, the driver that needs to perform packet classification and make a decision based on the information in the packet is a packet classifier (packet class).
ifier). In FIG. 1, a driver A 24 uses a packet classifier 32, a driver C 28 uses a packet classifier 34, and a driver D 30 uses a packet classifier 36. As mentioned above, the packetization of the original data may have different formats for different drivers. It is noted that the driver B26 performs packet processing so that packet classification is not required.

Each driver classifies different types according to the purpose of the driver. To better understand the different classification scenarios, a classification of a number of different types of network communication packets is shown. The simplest form of classification consists of comparing one value of a packet to a particular value. Table 1 below shows classifications based on matching with specific values.

[0012]

[Table 1]

Table 1 shows six possible different packet classifications based on the exact match of a packet with one of the destination addresses listed in the table. For example, one packet is
Only when the destination address is “11.22.33.44” is classified as belonging to classification 0. Similarly, an exact match of the destination address field for each packet to be classified is required for each of the other five classifications.

Another form of classification that is somewhat complicated is that two or more fields from the packet being classified are compared to a particular reference value and all must match to achieve the classification. is there. This is shown in the example of FIG. 2 below.

[0015]

[Table 2]

[0016] Table 2 shows six different multi-ports with values for destination address and destination port.
Indicates the field classification. For example, a packet has a destination address “11.
22.33.44 "and classification 0 only when the destination port is" 1 ".
Classify as belonging to Similarly, to classify a packet according to the other classifications shown in Table 2, both the destination address field and the destination port field found in the exact matching network packet must match each of the other five classifications. Must exactly match the corresponding entry.

Table 3 below introduces wildcards (represented by “x”) in the criteria specification to show more complex classification forms. More than one value can correspond to a value in a table with a wildcard.

[0018]

[Table 3]

Of the six classifications shown in Table 3, those with wildcard values can match more than one value or set of values from the packet to be classified. In other words, different values found in different packets can receive the same classification. On the other hand, classifications 0 and 1 do not contain wildcards and are therefore exact criteria designations, just like those found in Table 2 in order to classify an exact match Required. However, all packets having a destination address value of "11.22.55.66" fall under Category 2 regardless of the value of the destination port filed in the packet. Similarly, in the category 3, the destination address starts with “11.2.7.77” and “
All network packets having a destination port field value of "1" are relevant.

In essence, a wildcard is an abbreviation for a particular taxonomy set, and can be advantageously used in situations where all of the processing associated with a particular taxonomy group is the same. Classifications that include such wildcards, or that otherwise allow different values to be matched, are classified as general classifica
tion).

Since the general classification covers many different values, there is the potential for overlapping classifications. In other words, a given network packet can be properly classified into more than one classification. Such overlapping classification occurs in the following two different cases. (1) subsuming or hierarchical duplication, where each value and every value of one class is included in other higher-level classes, and (2) one class is not all, but not all, of the other classes Partial overlap, sharing some values. In inclusive overlap, packets that match a more specific classification fall by definition into more specific classifications, while in partial overlap, a given packet depends on the actual value of the relevant packet field. Therefore, it may or may not be included in both categories.

In general, classification requires that a single best classification category be returned,
Rules and other criteria must be introduced to return a single classification in the event of a duplicate condition. If one packet falls into many classes, the most specific one is often considered the best match. Therefore,
In the case of subsumption overlap, the most specific classification is usually used.

In partial overlap, the winning classification must be selected based on other criteria. This is because no classification is more specific than other classifications. One example of a criterion is an explicit and distinct priority attribute associated with each classification having a partial overlap state. Such evaluation criteria can be used to arbitrate between overlapping classifications and to get the best match in each case.

Table 4 below shows examples of subsumed and partially duplicated classifications.

[0025]

[Table 4]

Table 4 specifies six classifications, some are schematic and some are specific. A packet having a destination port address “11.22.33.44” and a destination port “1” falls into Class 0 and Class 1. Class 0 and Class 1 are subsumed overlapping classes, so according to the general rules, the best match is the most specific one, so
In this case, the classification is 0.

A packet having a destination address “11.22.55.66” and a destination port “2” falls under both Class 4 and Class 5. This is a partially overlapping situation. Classes 4 and 5 are both less specific than others and rely on priority information associated with duplicate classes to find the best match. Class 4 is shown to have a lower priority than Class 5, so the best match would be Class 5.

In order to simplify the process of classification, certain terms will be used throughout this specification. "Patterns" are all classification criteria that are linked together in some order. For example, the reference pattern is a concatenation of the destination address and destination port found in Table 4 for each classification. In other words, Table 4 contains six reference patterns, which can be matched with the corresponding classification patterns created by the actual values of the fields in the network communication packet. Again, the classification pattern is created by arranging the actual values captured from the packet in a prescribed order,
When a match is obtained as compared with a large number of reference patterns, a specific classification can be reached.

Generally, the packet classifier is developed independently in each driver as part of the development of the driver code. This implies duplication and complexity in the driver's code development, as packet classification is similar in all respects to all drivers. This inefficiency manifests itself in the form of extra time required to develop the packet classification code, and additional time required to debug and maintain the extra code.

Another problem is that during execution each driver must repeatedly classify the same packet. Each driver may perform the same classification on each packet as it passes up or down the protocol task, so redundant processing is done in the same way.

What is needed is a centralized packet classifier that is accessible by all drivers or other clients, and that can be used by individual drivers for the specific purpose of a particular driver. Generalizing and centralizing packet classifiers reduces code development for drivers that require packet classification, and centralizing packet classifiers can be used immediately by driver writers. Additional features can also be obtained.

There are two major issues that must be resolved before a centralized packet classifier can be effectively accepted by driver writers. First, the actual classification of a generalized and centralized packet classifier must have a reasonable amount of processing power so that the driver can perform its purpose within reasonable time criteria. Centralized packet classifiers used by many drivers often have potentially possible classifications or reference patterns in a larger database than individualized classifiers for a single driver, resulting in a larger reference pattern database Can affect the efficiency of the classification.

Another problem with generalized and centralized packet classifiers is that they may not be flexible enough to meet the specific needs of a particular driver.
When creating a personalized packet classifier as part of driver development, the driver writer must provide optimal performance and applicability (appl
icability), and will customize and adjust the driver code. The centralized packet classifier may not be flexible enough for all drivers to provide a complete interface to all drivers or clients to the classification service.

What is needed is a versatile and centralized packet traversal that provides drivers and other clients with classification services to provide sufficient flexibility to clients with different needs and objectives, and is effective on a functional basis. Classifier. In addition, such centralized packet classifiers must necessarily have adequate performance characteristics, and should be comparable in performance to the classifications that can often be achieved with individualized packet classifiers. Must. SUMMARY OF THE INVENTION Additional advantages of the invention will be set forth in the description that follows, and will be in part obvious from the description, and may be learned by practice of the invention. The advantages of the invention may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims.

According to the invention, embodied herein and broadly described, there is provided a method and computer program product for classifying network communication packets for processing in a network stack.

The present invention provides a method for processing network data during processing of packetized network data.
It is intended for a method of classifying packets when processing is performed across successive layered drivers in a stack. Packets are "classified" for different types of processing based on predetermined values in the packets, collectively known as a classification pattern.

The present invention is a generalized and centralized packet classification service or packet classifier that accommodates multiple drivers or other clients and simplifies packet classification code development for each driver. After registering one or more reference patterns along with the corresponding classification information that can be used to process the packet, any driver presents a classification pattern that can be matched against the stored reference pattern, and a match is obtained. If received, the corresponding classification information can be received and accessed. Having a centralized packet classifier represents a reduction in driver development time, debug time, and general code maintenance. Furthermore, what mechanism (fe
) can be used by any driver or other client for service.

The present invention overcomes the processing limitations associated with centralized and generalized packet classification, for which the reference patterns are separated into two different databases and the reference patterns are grouped into classification families. Has become A classification family is a group of drivers or other clients that share a set of packet classification information.

A rough reference pattern that can match two or more classification patterns is stored in a rough pattern database. The search time may vary depending on the amount and type of data stored. In order to reduce the search time, a rough pattern database is provided for each classification family.

The specific reference pattern for all classification families is
Store in an absolute pattern database such as a hash table. This database has a constant search time regardless of the number of absolute reference patterns contained therein. In response to a classification request, the centralized packet classifier
The absolute pattern database is searched first, followed by the general pattern database of the classification family. This configuration has the advantage that the processing capacity is equivalent to a customized classification code.

These and other features of the present invention will become more fully apparent from the following description and appended claims, and may be learned by the practice of the invention as set forth hereinafter.

To obtain the above-cited and other advantages of the present invention, a more particular description of the invention briefly described above will be rendered with reference to specific embodiments illustrated in the accompanying drawings. Do. BRIEF DESCRIPTION OF THE DRAWINGS These drawings show only exemplary embodiments of the invention and, therefore, are not to be taken as limiting the scope thereof, but rather specific and detailed descriptions of the invention with reference to the accompanying drawings. Describe and explain. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS As used herein, the term "software component" is individually recognizable to the operating system that manages the computer system.
Shall mean any set of executable instructions. Examples include separate processes or threads, application programs, system device drivers, and any other such operating system entities.

As used herein, the term “driver” refers to a software driver program that runs in a privileged system environment and interacts with the I / O subsystem as part of the operating system architecture. It shall be. Such drivers are distinguishable from application programs and other software.

As used herein, the term “client” is intended to mean any piece of code that can use the inventive centralized packet classifier disclosed herein. A single software component, such as a driver, may require multiple classifications, and thus can be viewed as multiple clients from the perspective of a centralized packet classifier. In other words, the centralized packet classifier does not necessarily distinguish the source of the classification request.
This is merely a means of classifying network communication packets.

As used herein, the term “pattern” refers to a specific or generic value of a field in a packet or packet header that is concatenated together in a predetermined order and is considered a bit set or sequence. And

A “reference pattern” is a pattern that can be used by a particular driver or software component and that associates certain classification information that is maintained in a database by a centralized packet classifier. An “specific reference pattern” is a reference pattern that has a specific value for each value and every value therein. A "general reference pattern" is a wildcard that can have any value such that a different pattern can match the general reference pattern.
One or more reference patterns contained inside. In this way, the rough reference pattern can be regarded as a simplified method for specifying a group or a set of absolute reference patterns.

A “classification pattern” is a pattern presented to a generalized packet classifier by a driver or other client, and is made from the actual values of the packets to be classified. If the classification pattern matches the reference pattern (either absolute or approximate), access to the classification information associated with the matched reference pattern is returned to the driver, which uses it to process packets according to the classification. can do.

As used herein, the term “classification information” means any relevant information related to the reference pattern. Examples of such classification information include a simple numerical indication of the classification, a block of data that can be used to perform the next operation, or any other information useful to the driver in the operation.

As used herein, the term “classification family” shall mean a set of logically related reference patterns shared by many drivers. This allows a collection of drivers or other clients to share a database of related classification information. When used here, each reference pattern includes
Classification families are associated so that different classification information can be used with exactly the same reference pattern based on the classification families.

As used herein, the term “classification block” is a data block associated with an absolute reference pattern, and is used to access the classification information of all the classification families installed for that absolute reference pattern. It shall mean what can be used. One embodiment of the classification block disclosed herein is a list of pointers that can be indexed by classification family.

As used herein, the term “classification handle” is a citation to all different classification information associated with a given absolute reference pattern. In other words, using a classification handle with a particular classification family allows the driver to reach the classification information for a given absolute reference pattern and classification family. For example, one implementation of a classification handle is a pointer to a classification block. The classification handle is useful when the absolute reference pattern has already been obtained and known and only the classification family needs to be used with the classification handle to reach the desired classification information.

FIG. 2 and the following discussion are intended to provide a brief, general description of a suitable computing environment in which the invention may be implemented. Although not required, the invention will be described in the general context of computer-executable instructions, such as program modules, being executed by a personal computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. Further, the present invention relates to other computer system configurations, including handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, etc. Those skilled in the art will recognize that this can also be performed using The present invention can also be implemented in a distributed computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

Referring to FIG. 2, one example of a system for implementing the present invention is a conventional personal computer.
It includes a general purpose computer in the form of a computer 40 and includes a computing unit 41, a system memory 42, and a system bus 43 that couples various system components including the system memory to the computing unit 41. System bus 43 may be any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory includes a read only memory (ROM) 44 and a random access memory (RAM) 45. A basic input / output system 46 (BIOS) containing basic routines useful in transferring information between elements within personal computer 40, such as during start-up, is stored in ROM 44. Further, the personal computer 40 includes a hard disk drive 47 that reads and writes a hard disk (not shown), a magnetic disk drive 48 that reads and writes a removable magnetic disk 49, and a CD ROM or Optical disk drive 5 for reading and writing to removable optical disk 51 such as other optical media
Contains 0. The hard disk drive 47, the magnetic disk drive 48, and the optical disk drive 50 are connected to the system via a hard disk drive interface 52, a magnetic disk drive interface 53, and an optical drive interface 54, respectively. It is connected to a bus 43. The drives and their associated computer-readable media provide nonvolatile storage of computer-readable instructions, data structures, program modules, and other data for personal computer 40. One example of the environment described here employs a hard disk, a removable magnetic disk 49 and a removable optical disk 51, but includes a magnetic cassette, a flash memory card, a digital video disk, a Bernoulli cartridge, a random access memory. Other types of computer-readable media capable of storing computer-accessible data, such as (RAM), read-only memory (ROM), etc., may also be used in one example operating environment. It will be appreciated by those skilled in the art.

A number of program modules, including an operating system 55, one or more application programs 56, other program modules 57, and program data 58, are stored on a hard disk, magnetic disk 49.
, The optical disk 51, the ROM 44 or the RAM 45. A user can enter commands and information into the personal computer 40 via input devices such as a keyboard 60 and a pointing device 62. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices connect to the computing device 41 via a serial port interface 66, which is often coupled to the system bus, but with a parallel port, game port or universal serial bus ( It is also possible to connect via other interfaces such as USB).
A monitor 67 or other type of display device is also connected to the system bus 43 via an interface, such as a video adapter 68. In addition to the monitor, personal computers typically also include other peripheral output devices (not shown), such as speakers and printers.

The personal computer 40 has one, such as a remote computer 69,
It can also operate in a networked environment with logical connections to one or more remote computers. Remote computer 69 may be another personal computer, server, router, network PC, peer device, or other common network node, and typically includes the elements described above with respect to personal computer 40. Including many or all of
FIG. 2 shows only the memory storage device 70. The logical connections shown in FIG. 2 include a local area network (LAN) 71 and a wide area network (WAN) 72. Such networking environments are commonplace in office enterprise-wide computer networks, intranets and the Internet.

When used in a LAN network environment, the personal computer 4
0 connects to the local network 71 via the network or the adapter 73. When used in a WAN networking environment, personal computer 40 typically includes a modem 74 or other means for establishing communication over a wide area network 72, such as the Internet. The modem 74 may be internal or external, and is connected to the system bus 43 via a serial port interface 66. In a networked environment, program modules depicted relative to the personal computer 40, or portions thereof, may be stored remotely.
It is also possible to store it in a memory storage device. It will be appreciated that this network connection is one example and that other means of establishing a communication link between the computers can be used.

Referring now to FIG. 3, the centralized packet classifier 80 and the network
FIG. 2 shows a logic diagram similar to FIG. 1, illustrating bi-directional processing with various drivers in a stack. The centralized packet classifier 80 is used as a means for classifying network communication packets processed by the drivers of the network stack.
Again, the application program 82 is about to send data over the network via the network interface card 84 and passes information through a plurality of stacked drivers that are processed sequentially. Information is
First, the application 82 shifts to the driver A 86, and then the driver B 88
To the driver C90, and finally to the driver 92, and then out through the communication network under the control of the network interface card 84.

Each driver that requires a classification service for network communication packets during processing can perform classification using a centralized packet classifier 80.
As shown in FIG. 3, the driver A 86
Use a classifier. Similarly, driver C90 and driver D92 also use centralized packet classifier 80. Note that driver B88 may perform internal packet classification, but does not use a centralized packet classifier.

In order to prevent a potentially large reference database from reducing the efficiency of the classification process, the centralized packet classifier of the present invention employs two main techniques. First, patterns are distributed to different databases depending on whether the pattern is an absolute reference pattern or a rough reference pattern. A single absolute reference pattern database ("absolute database") for all taxonomic families
), And there is one rough reference pattern database for each classification family (the “short database”). By having a separate summary database for each classification family, the database size of one classification family is reduced by the classification of other classification families when searching for a rough reference pattern for a match with the proposed classification pattern. It has no effect. Second, the size of the database is independent of the actual search time because all the absolute reference patterns in the absolute pattern database are stored in a searchable data structure within a certain period of time. Storing patterns in a database is also referred to as installing in the database or system of the present invention.

From each installed schematic reference pattern, one for the appropriate classification information according to the classification family and summary database associated with the individual schematic pattern.
There are two pointers. From each installed absolute reference pattern, there are a number of pointers to the appropriate classification information, with each pointer corresponding to each classification family with a matching pattern installed in the absolute database.

Referring now to FIG. 4, there is shown a logic diagram of an example classification system having two classification families for use in a packet classifier according to the present invention. Table 5 below shows the information included in the classification system shown in FIG.

[0062]

[Table 5]

Referring now to FIG. 4, the summary pattern database or summary database 96 for classification family 1 has an entry pointing to classification family information 98 for classification family 1 and the summary database 100 for classification family 0 includes classification family 100. 0, and the absolute pattern database or absolute database 104 contains the classification family information 98 of classification family 1 and the classification family 0.
Has an entry indicating both of the classification information 102.

Here, the absolute database 104 is referred to, and as an example, the absolute reference pattern “10
The entry 106 of “1100” is examined in detail. In addition to the actual absolute reference pattern, entry 106 points to classification block 108, as indicated by arrow 110, and includes a reference count field 112 therein. The reference count field 112 includes an absolute reference pattern for this entry, explicitly installed therein (eg, “101100 for this entry”).
)) Indicates the number of classification families.

The absolute pattern is explicitly installed in the classification family when the client installs or automatically installs as a result of a client search. Both of these procedures are described below. The absolute pattern is explicitly installed when updating the classification block as a performance improvement resulting from the installation of the general pattern. This process will be described later. Explicit installation does not increment the reference count field.

In the example entry 106, two specific absolute reference patterns have been installed, an explicit installation of classification family 0 and an implicit installation of classification family 1. Therefore, its reference count field 112 has a value of one. The classification block 108 includes a pointer to specific classification information depending on the classification family. For example, pointer 114 points to classification information 0a 116, while pointer 118 points to classification information 1d 120. Pattern "010
Note that the entry "100" has a unique pointer in the classification block 124 and a reference count field 126 of one. If a specific absolute reference pattern is not installed for a specific classification family,
The classification block contains no value for that pointer. The entry's reference count indicates only the number of explicitly installed instances of a particular absolute reference pattern (i.e., the classification information associated with the client installation or automatically installed as a result of the client's search). With classification information). Explicit installs may be present but are not reflected in the reference count.

In order to have a fixed search time, the structure of the absolute database must be carefully selected. The present invention provides a hash table for this purpose.
That is, the Improved Hash Table Expansion and filed on Aug. 12, 1997.
US patent application Ser. No. 0, entitled Contraction for Use with Internal Searching.
No. 08 / 0911,105, including an incrementally sizable hash table. The contents of this patent application are incorporated herein by this reference.

In addition to storing in a hash table, each absolute reference pattern is also stored in a Patricia tree, a structure commonly known in the art. The Patricia tree can quickly search the absolute pattern database and find all absolute reference patterns that match a given rough reference pattern. This is a utility operation that needs to be performed in connection with the installation and removal of the reference pattern, and will be described in more detail below.

Since the universal reference patterns contain wildcards and thus are not as simple values as the absolute reference patterns, they cannot be stored in the conventional constant search time data structure. One of the data structures corresponding to the storage of the rough reference pattern and corresponding to the inclusion of the overlapping pattern (i.e., the match is determined to be the most specific among the hierarchically related and subsuming overlapping patterns) is the A Technique for Efficiently Clas
sifying Packets Using a Trie-Indexed Hierarchy Forest that Accommodates
U.S. patent application Ser. No. 08/933, entitled Wildcards, a technique for efficiently classifying packets using triple indexed hierarchical forests corresponding to wildcards.
, 476, there is a Rhizome data structure.
The contents thereof are incorporated herein by this reference.

In order to determine an actual best matching pattern during a search for a partially overlapping general reference pattern, priority information is required. This uses an array of Rhisome data structures, one for each priority level, with Rhizo at the highest priority level.
This is achieved by performing a search in the zoom, and then performing a search in each successive priority level until a match is found or until all the priority levels in the array are exhausted. Returns the most specific approximate reference pattern in the case of subsumed overlapping approximate reference patterns, or returns the higher-priority approximate reference pattern for the search in the case of partially overlapping approximate patterns. One skilled in the art will recognize that other methods and means may be used to implement the general reference pattern database.

It is noted that the illustrated entry 128 includes an actual reference pattern 130 having a value of “101XXX”, a pointer 132 indicating the classification information 1 c 134, and a priority field 136 having a value of zero. If the classification families are not expected to have non-hierarchical or partially overlapping schematic patterns, embodiments of the present invention may not require priority information to distinguish partially overlapping rough reference patterns. The skilled artisan will appreciate.

To perform a search in the reference pattern system split here into an absolute database and a schematic database as shown in FIG. 4, a search is performed on the absolute database and then until a match is obtained for a particular classification family. Perform a search in the summary database. This process is described in more detail below in connection with FIG.

When a driver or other client installs a reference pattern, the centralized packet classifier first checks whether the reference pattern is absolute or schematic by checking for wildcards within the reference pattern. Is determined. If the reference pattern does not include a wildcard, this is absolute and the processing steps of the flow chart shown in FIG. 5 are executed.
On the other hand, as for the reference pattern including the wild card, since these are rough, the processing steps of the flowchart shown in FIG. 7 are executed.

Referring now to FIG. 5, the process steps for installing an absolute reference pattern in an absolute database are shown. If you provide a reference pattern for installation,
The driver or other client may use this reference pattern, related classification information,
The classification family and priority information in the case of the general reference pattern are presented. After starting in step 136, in step 138 the absolute database is searched for a new absolute reference pattern provided by the driver or other client to the centralized packet classifier. As described above, this search can be performed relatively quickly within a certain period of time. This is because absolute databases use hash tables or other constant search time structures.

At step 140, a determination is made as to whether the absolute database already contains a new absolute reference pattern in one of its entries. If so,
In step 142, the classification block is accessed and the pointer associated with the new absolute reference pattern classification family therein is set to point to the specified classification information. In addition, since the installation is explicit by the client, step 142 also increments the reference count field. Finally, the process ends at step 144 and the pattern is installed. This situation involving step 142 also occurs with an absolute reference pattern already installed for another classification family, so that the absolute database entry structure is already created and in place, and to perform the installation, step 142 Note that only the changes need to be made, as described in.

If it is determined in step 140 that the absolute database does not contain the new pattern, a data entry must be created and initialized in step 146 for the new absolute pattern. This process installs a new absolute pattern in the absolute database, creates a classification block, and sets a pointer pointed to by the client-supplied classification family to point to the specified classification information. In addition, since this is an explicit installation by the client, set the reference count to 1 for this entry.

In this way, a new absolute pattern exists in one classification family, and the entire outline database of the classification families other than the classification family of the client is searched to find an outline reference pattern that matches the new absolute reference pattern. If a match is found,
Setting up the absolute database so that matches with other classification families are found during the absolute database search increases efficiency and reduces classification time. At step 148, the first of these summary databases is searched for the best match for the new absolute pattern.

At step 150, a determination is made as to whether the particular summary database includes a new pattern. If so, in step 152, the classification block is adjusted to reference (re) the specified classification information found from the summary database search.
ference). This process sets the pointer in the classification block pointed to by the classification family in the summary database to point to the corresponding classification information. Note that the reference count of the absolute database entry associated with the new absolute reference pattern is not incremented. This is because this is an implicit installation due to performance enhancement based on the match of the newly installed pattern's summary database for classification families other than those that explicitly install absolute patterns.

If the summary database does not include the new absolute reference pattern, step 154
In, it is determined whether or not all the relevant summary databases have been searched. If the search has been completed, the process ends in step 144; otherwise, in step 156, the next general database is searched for the best match with the new absolute pattern. In this way, all the summary databases other than the summary database of the classification family of the new absolute reference pattern are searched, and the best match with the newly installed absolute reference is obtained. Each time a match is obtained, the absolute database installs a new reference pattern for the classification family and automatically obtains classification information from a search of the corresponding summary database.

FIG. 4 illustrates how to install the absolute reference pattern.
Two patterns are added to the logic diagram shown in FIG. That is, the absolute reference pattern “0101”
00 ”is added to the classification family 1, and the absolute reference pattern“ 011100 ”is added to the classification family 1. FIG. 6 shows the logic diagram of FIG. 4 after adding two absolute reference patterns.

The absolute reference pattern “010100” associated with the classification information 1a 158
To the classification family 1, the processing steps of the flow chart of FIG. 5 are performed, and in step 140 the absolute database already contains the new absolute reference pattern entry 122, as seen in FIG. Is determined. Therefore, the process proceeds to step 142, and the pointer in the classification block is changed from null to indicate the classification information 1a 158. Since this is an explicit client installation, increment the reference counter field 126 of entry 122 from one to two, as seen in FIG. Note that no new entries are created, and such installations occur faster than those that require the creation of new entries in the absolute database.

To install the absolute reference pattern “011100” of the classification family 1 with which the classification information 1a 158 is associated, a new entry 162 is created as shown in FIG. To do this, during the processing steps performed in the flow chart of FIG. 5, the new absolute reference pattern does not exist in the existing entry of the absolute database in step 140 and step 146 must be performed. There are cases. With these steps, a new entry having a pointer to the classification information 1a 158 is created in the classification block. Since this is an explicit client installation, the reference count field 164 is initially set to one.

As the algorithm searches all summary databases for other classification families, a match of the absolute reference pattern is obtained in the summary database 100 for classification family 0. When searching the summary database 100 for category 0, the rough reference pattern found therein, indicated by entry 168, is
d 166. Here, in the classification block of the absolute database 104, a pointer is created for the entry 162 related to the classification family 0, and points to the classification information 0d 166 found during the immediately preceding search. Thereafter, if the classification is performed and this absolute reference pattern is present for classification family 0, a search in absolute database 104 is sufficient without resorting to an extra search in summary database 100 for classification family 0.

At this point, FIG. 6 shows that the absolute reference pattern “01010”
5 shows an example of the classification system of FIG. 4 in which an absolute reference pattern “011100” is added to the classification family 1. Absolute reference pattern “01110” of classification family 1
Along with the installation of "0", the same reference pattern of classification family 0 is found in the rough reference pattern found in the rough reference database 100, and the corresponding absolute reference pattern is installed in classification family 0 to improve efficiency. Aim. In the deletion (de-installation) of the absolute reference pattern shown later in FIG. 11, the absolute reference pattern “011100” is also automatically deleted from the classification family 0.

Referring to FIG. 7, the processing steps performed by the centralized packet classifier to install the general reference pattern will be described in detail. The rough reference pattern includes at least one wild card as described above. The driver or other client that installs the general reference pattern may use the centralized packet / package to specify the general reference pattern, the classification family associated with the general reference pattern, the classification information, and the priority used to resolve the partially duplicated condition. Present to the classifier.

After starting in step 168, step 170 installs a new general reference pattern in the general database associated with the particular classification family. In addition, a pointer indicating the designated classification information is set. Step 1
At 72, the absolute database is searched for an existing absolute reference pattern entry that matches the new schematic pattern. If an absolute reference pattern that matches this general reference pattern already exists, a link to classification information related to the installed general reference pattern is formed in the absolute database. This improves search efficiency and reduces total classification time. The rough reference pattern can be extended to a set of absolute reference patterns, and the purpose of searching the absolute database is to find all currently installed absolute reference patterns that match the rough reference pattern to be installed.

If it is determined in step 174 that the absolute reference pattern that can match the newly installed general reference pattern is no longer in the absolute database, the process for installing the new general reference pattern ends in step 176.
Otherwise, the corresponding absolute reference pattern is used to access a corresponding classification block containing a pointer for each classification family defined in the system.

In step 178, it is determined whether or not the pointer in the classification block for the classification family of the newly installed general reference pattern currently indicates any classification information. If the corresponding pointer in the classification block determined in step 178 is null, ie, has no associated classification information, then in step 180, the pointer is moved to point to the classification information associated with the newly installed general reference pattern. set. This is efficient in that a search of the absolute database allows for quicker access to the classification information before actually searching the summary database. Next, the search loop is repeated for the next match with the rough reference pattern found in the absolute pattern database in step 182.

If it is determined in step 178 that the pointer in the classification block corresponding to the classification family of the installed general reference pattern has already pointed to the classification information or has been allocated by another method, in step 184 the classification information is A determination is made as to whether the assignment was made explicitly or automatically to a particular reference pattern. The explicit assignment is not automatically installed during the installation of the absolute reference pattern or the summary pattern of another classification family, but rather the absolute reference pattern is installed independently in the absolute database Is the case. In other words, automatic installation can be performed as a performance enhancement that is a by-product of installing another independent reference pattern.

If it is determined in step 184 that the classification information has been explicitly assigned, no further action needs to be performed, and the process proceeds to step 182 in the absolute database that matches the rough reference pattern. Proceed to search for. Explicit assignment naturally takes precedence over automatic assignment to improve performance.

If it is determined in step 184 that the classification information has not been explicitly assigned,
If the best match is found in the summary database for a particular classification family, the associated classification information is assigned to the absolute reference pattern for that classification family. This is done in step 186, which searches the summary database for the best match to this absolute criterion. Note that the installation of the new global reference pattern may or may not change the best match to the resulting absolute reference pattern. In other words, existing classification information that was not explicitly assigned due to the fact that there are more specific overlapping rough reference patterns or that there are partially overlapping rough reference patterns with higher priority Could already be the best match.

Based on the result of the search performed in step 186, the pointer in the absolute reference pattern classification block corresponding to the newly installed general reference pattern classification family may point to the classification information specified by the search in step 188. Is set to

At this point, in step 182, the next matching is performed on the pattern that matches the new rough reference pattern in the absolute database for processing. Here, as described above, if it is determined in step 174 that another matching absolute reference pattern could not be found, the process proceeds to step 176.
Ends at

Another performance advantage achievable in certain embodiments includes automatically extending the approximate reference pattern to a corresponding set of absolute reference patterns. This set of absolute reference patterns can be installed in the absolute database so that any match against the rough reference pattern can be made in the absolute database with a fixed search time. This may be practical for rough reference patterns where a relatively small number of wildcards are found internally, but may be too inefficient for rough reference patterns extending to large sets of absolute reference patterns. There is. Those skilled in the art will appreciate that the aforementioned auto-extension and other performance-enhancing changes are made to improve the efficiency of the classification in the present invention.

To exemplify the installation of a new general reference pattern, the classification information 0c 1
The pattern “01X100” of the classification family 0 having a priority of 0, which is related to 90
Here is an installation example. Once the installation is complete, the logical diagram of the example classification system of FIG. 6 is as shown in FIG.

First, in step 170, a new general reference pattern is installed as the entry 196 in FIG. 8, and the pointer points to the classification information 0c 190. As part of the process, two absolute reference patterns are found in the absolute database 104: the pattern “011100” represented by entry 162 and the pattern “010100” represented by entry 122. Entry 122 has already been explicitly installed for classification family 0 and points to classification information 0b 195, and entry 162 initially appears as a result of the implicit installation, as seen in FIG. Classification information 0d 1
Note that it points to 66. For each of these two patterns, the pointer in the classification block indicated by the classification family has already been allocated, as determined in step 178 (FIG. 7). Therefore, the process of step 180 is not executed.

Referring to the determination as to whether or not the classification information has been explicitly assigned in step 184, the entry 122 corresponding to the reference pattern “010100” has been explicitly assigned. Therefore, the entry 122 is not affected at all by the addition of the new rough reference pattern.

However, this is not the case with entry 162, which was automatically assigned to classification family 0 as part of the installation of the absolute reference pattern “011100” of classification family 1 already described. there were. Accordingly, processing steps 186 and 188 are subsequently performed, and the classification information corresponding to the highest match found in the rough reference database is automatically reassigned to this absolute reference pattern.

Using the absolute reference pattern “011100”, the general pattern of the classification family 0
By searching the database 100, the newly added general reference pattern, indicated by entry 196 (FIG. 8), is the best match. Because this is the most specific match. Therefore, the pointer in the classification block corresponding to entry 162 for classification family 0 no longer has classification information 0d.
166 is changed to indicate the classification information 0c as shown in FIG.

Referring now to FIG. 9, a flow chart illustrating the processing steps performed to classify a classification pattern received from a driver or other client will be described. The driver or other client creates a classification pattern by taking the values from the packets to be classified and concatenating them together in the appropriate order. After starting in step 198, in step 200, the centralized packet classifier receives the client-created classification pattern or client pattern along with the client's classification family.

First, in step 202, a search is performed in the absolute database to obtain a client classification pattern. If an entry corresponding to the client classification pattern is found in the absolute database, the associated classification block can be accessed and the appropriate pointer in the classification block is accessed using the client's classification family. If the pointer in the classification block corresponding to the classification family is non-null, it is considered in step 204 that a classification pattern has been found.
If there is no entry for the client classification pattern, or if the entry is present but the pointer is null for the client's classification family, it is considered in step 204 that the pattern was not found.

If a pattern is found in step 204, a pointer to the classification information and a handle of the classification block are returned to the client in step 206, and then the process ends in step 208. A pointer to the appropriate classification information can be used by the driver or other client when processing a packet that is currently being classified. The classification handle is useful in later processing when another driver may have to perform a classification that may belong to a different classification family. In other words, a driver can pass a classification handle to another driver, which allows other or current drivers to search the centralized packet classifier without searching the absolute or summary database. Can be used to perform the classification more quickly and efficiently. The classification handle is a more reliable means of reaching the actual classification information than a pointer to the information itself. Because the classification information, and thus the pointer, can change during another operation of the centralized packet classifier, such as the installation and removal of a reference pattern, or the expiration of an automatically installed reference pattern. Because.

If it is determined in step 204 that no pattern has been found, step 21
At 0, the general database corresponding to the classification family of the client classification pattern is searched to find an existing general reference pattern that matches the client classification pattern. If it is determined in step 212 that a match with the client pattern has been found, then in step 214 the client pattern is installed in the absolute database using the steps of the flow chart enclosed by dashed line 216 in FIG. The operation of these steps has already been described. All other summary databases of the other taxonomic families are similarly searched to maximize installation.

Next, in connection with this automatically installed client classification pattern,
At step 218, a timer can be set to cause this pattern to remain installed in the absolute database as an absolute reference pattern for a period of time. When the timer expires, the absolute reference pattern is automatically deleted. The reason for a temporary installation is that a given client classification pattern is often used many times by the current driver and other drivers in the network stack. By using the classification patterns already installed in the absolute database in other classification trials, future classification trials with a centralized packet classifier can be performed more efficiently.

Once the classification block is set by installing the client pattern in step 214 and the timer is set in step 218, the classification handle and the classification information pointer are returned to the client in step 206, and then the process ends in step 208 . Note that as far as the driver or other client is concerned, there is no discrepancy between the classification information pointer and the classification block handle retrieved from either the absolute or summary database.

If it is determined in step 212 that the client classification pattern is not found in the summary database, then in step 220, a pattern that matches neither the absolute database nor the summary database for the particular classification family could be found. , Returns an indication to the client that the classification could not be performed. Finally, the process ends in step 208.

An example of starting from the logical diagram of FIG. 8 as a starting point and searching for a nonexistent pattern is shown in FIG.
Are shown while following the processing steps of. That is, “10111” of the classification family 1
A client classification pattern of "1" is presented to the centralized packet classifier. After searching the absolute database in step 202 (FIG. 9), no pattern is found. Next, in step 210, a search is performed of a summary database corresponding to the classification family of the client. The client pattern matches the general pattern “101XXX” in the general database 96 of the classification family 0. At step 214, the client pattern is installed in the absolute database. On the other hand, as part of the installation at step 214 following the processing step of FIG.
The collation performed on the schematic pattern database of the classification family 1 being searched performed in FIG. 5) causes the pointer in the classification block for the classification family 1 to point to the corresponding classification information. Since no client classification pattern for classification family 0 was found in the corresponding summary database during installation, the newly installed timed absolute database entry (timed spec
The classification block of the ific database entry) remains null for classification family 0. Note that as part of the installation at step 214, a check is performed and matched against the general pattern in other classification families.

Next, at step 218, a timer is set for the aforementioned entry, and then at step 206, a pointer to the classification handler and the classification information is returned to the client. Note that the same information is returned to the client regardless of whether the pattern was found in the absolute or summary database.

Referring now to FIG. 10, there is shown a logic diagram of a classification system similar to FIG. 8, where an absolute reference pattern is added by a driver or other client initiated classification request. A timer 224 is associated with the new entry 222.
Except for the pattern value 226 of “101111”, the reference count value 228 is initially set to 1
Set to. Since no absolute reference pattern for classification family 0 was found, pointer 232 to reference block 230 is null and pointer 234 points to classification information 1c 134.

Referring now to FIG. 11, the processing steps performed by the centralized packet classifier to delete the absolute reference pattern are shown. After starting at step 236, at step 238, the value of the reference count field of the entry in the absolute database for the particular absolute reference pattern is decremented by one. Step 24
At 0, a determination is made as to whether the value of the reference count field is equal to 0, and if so, the absolute reference pattern entry is completely removed from the absolute database at step 242 and then the process ends at step 244. I do. In essence, a reference count field value of 0 indicates that this absolute pattern was not explicitly installed for any classification family and should therefore be removed.

If it is determined in step 240 that the reference count field value is not equal to 0, then in step 246 a search is performed in the summary database of the classification family indicated by the delete operation to find the best match for the absolute reference pattern. Ask. Even if an absolute reference pattern is deleted for a particular classification family, a match with the absolute reference pattern may still exist in the general pattern database. In such a case, the efficiency is improved by placing a pointer to an appropriate location in the classification block and the relevant classification information.

If a matching general reference pattern is found at step 248, the pointer in the classification block indicated by the classification family is set to point to the classification information found during the search of the general database performed at step 246. Step 2
The pointer is set at 50, and then the process ends at step 244.

If it is determined in step 248 that no matching general reference pattern is found, the pointer in the classification block indicated by the classification family is set to null in step 252, and the process ends in step 244. In that case, there would really be no classification information available for that absolute reference pattern and classification family.

Referring now to FIG. 12, there is shown a logic diagram of the configuration system shown in FIG. 10 after removing the three absolute reference patterns according to the processing steps described in FIG. That is, by removing the absolute reference pattern “010100” of the classification family 0, the classification information indicated by the corresponding pointer is changed, and the classification family 0 is deleted.
By completely removing the absolute reference pattern “101100” from the database, the absolute reference pattern “100” of the classification family 0 is completely removed.
111 "is removed and the corresponding pointer is set to null.

When removing the absolute reference pattern “101100” of the classification family 0, FIG.
The reference count eventually equals zero, as determined in step 240 of FIG.
The entire reference pattern is removed from the reference pattern database 104, as indicated by the arrow 254 pointing to the previously existing and lost entry, as shown at 0. Note that the implicit installation of the absolute reference pattern “101100” of classification family 1 is also removed. Any effort by the client to classify the absolute reference pattern of Classification Family 1 results in automatic installation by the timer, as described above.

With respect to the removal or deletion of the absolute reference pattern “100111” of classification family 0, the entry 106 in the absolute pattern database 104 became 1 due to the decrease of the absolute pattern reference count field 112 in step 238 of FIG. Shows the value of the reference count field 112. Step 2
As no match was found in the general pattern database for classification family 0, as determined at 48, pointer 114 of classification block 108 corresponding to classification family 0 was set to null in step 252 (FIG. 11). The pointer 118 of the classification block 108 is still the classification information 1a 1 of the classification family 1.
Note that it indicates 19.

Regarding the deletion of the absolute reference pattern “010100” of the classification family 0, FIG.
Of the entry 122 is applied. After the reference count field is decremented in step 238 and the rough database is searched in step 246 of FIG. 11, if a matching rough reference pattern is found in the rough database in step 248, the pointer stores the classification information 0c 190. Point. This is done because a match with the rough reference pattern “01X100” found by entry 196 in the rough pattern database 100 for classification family 0 is found. In other words, entry 122 in classification family 0
Is switched from the classification information 0b 163 to the classification information 0c 190.

Referring now to FIG. 13, the processing steps performed to remove the general reference pattern from the general database will be described in detail. After starting at step 270, the general reference pattern, along with any classification information associated with it, is completely removed from the general database.

Next, the absolute database is searched to find all absolute reference patterns that match the set of absolute patterns corresponding to the general reference pattern. In step 274, the absolute database is searched for the first match to the rough reference pattern. If it is determined in step 276 that a matching absolute reference pattern can no longer be found, the process ends in step 278. Otherwise, the body of the flow chart continues until all matching absolute patterns have been found and processed.

If it is determined in step 276 that a matching absolute reference pattern has been found, then in step 280 a determination is made as to whether classification information for a particular classification family has been explicitly assigned to this absolute reference pattern. If assigned, the absolute reference pattern was designed more specifically and was not automatically assigned in any way, so no new processing is required. Therefore,
In step 282, the absolute database is searched for the next match to the approximate reference pattern, and the loop is repeated.

If it is determined in step 280 that the classification information has not been explicitly assigned, the summary database is searched in step 284 for the best match for this particular absolute pattern and classification family. The result of such a search is
Indicates null if no best match was found, otherwise indicates classification information associated with the best match. In step 286, the classification block pointer of the entry indicated by the classification family is set to point to the classification information obtained from the search performed in step 284. In essence, it reinstalls the automatically installed absolute reference pattern and automatically gets the best match from a generic database for a particular classification family. In some cases, the pointer in the classification block changes, and in other cases it does not.

Referring now to FIG. 14, there is shown a logic diagram representing the exemplary classification system of FIG. 12 after the general reference pattern has been removed. That is, the general reference pattern “01XX00” of the classification family 0 having the priority of 0 is removed according to the processing steps described in the flowchart of FIG. In FIG. 14, this is indicated by an arrow 288 indicating the lost entry of the general reference pattern.

After removal of the rough reference pattern from the rough database in step 274 of FIG. 13, three matching absolute patterns are found in the absolute pattern database corresponding to the last removed rough reference pattern (“01XX00”). Can be That is, the entry 162 of the absolute reference pattern “011100”, the entry 122 of the absolute reference pattern “010100”, and the reference pattern “011000”
292. For entries 122 and 162, classification information is implicitly assigned as a result of an explicit installation of a pattern for classification family 1. Therefore, a better match could not be found, so an adjustment would be needed and the summary database for classification family 0 would be searched again in each case and the same classification information would be reassigned to the pointer.

For entry 292, the classification information was implicitly assigned to the absolute reference pattern of classification family 0. Therefore, if such a determination is made in step 280, the classification family 0
Is searched again in step 284. The result of this search indicates that there is no other general reference pattern that matches the absolute reference pattern “011000”. In step 286, entry 2 with pointer 296
Adjust the classification block 294 associated with 92 so that the pointer 296 is now null. Thus, the automatically generated reference to the classification information of the absolute pattern database 104 is coordinated by the removal of the general pattern database 102 of the classification family 0.

The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects as illustrative and not restrictive. Therefore, the scope of the present invention should be indicated by the appended claims rather than by the foregoing description. All changes that come within the meaning and range of equivalency of the claims are to be embraced within their scope.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a network stack of interconnect drivers that process network communication packets, each with an individual packet classifier in each driver, as is common in the prior art.

FIG. 2 is a block diagram of an example of a system for realizing the present invention, including a general-purpose computer in the form of a conventional personal computer.

FIG. 3 is a block diagram illustrating a network stack of interconnect drivers using a centralized packet classifier for drivers requiring packet classification corresponding to the same drivers shown in FIG. 1 according to the present invention.

FIG. 4 is a logic diagram showing a database structure of a centralized packet classifier according to the present invention. That is, each absolute reference pattern entry shows an absolute database that indicates appropriate classification information according to the classification family, and a general database for each classification family that contains a general reference pattern entry and a pointer to the corresponding classification information. . In this example, there are two classification families.

FIG. 5 is a flow chart showing the process steps for installing a new absolute pattern for a given classification family into an absolute database.

6 is a logic diagram showing the database organization and example of FIG. 4 after installing a number of new absolute reference patterns into the system according to the processing steps described in the flow chart of FIG. 5;

FIG. 7 is a flow chart showing the processing steps required to install a general reference pattern into a general database associated with a particular classification family.

FIG. 8 is a logic diagram showing the database organization and example of FIG. 6 after installing a new general reference pattern according to the processing steps described in the flow chart of FIG. 7;

FIG. 9: Receives a classification pattern and first converts it to a reference pattern in the absolute
A flow that indicates the processing pattern required to classify the packet by comparing it to a reference pattern in the summary database for a particular classification family.
It is a chart. Further, a step of temporarily installing the client classification pattern in the absolute database to improve the efficiency is shown.

FIG. 10 is a logic diagram showing the database organization and example of FIG. 8 after adding a temporarily installed absolute pattern according to the processing steps described in the flowchart of FIG. 9;

FIG. 11 is a flow chart showing the processing steps required to remove an absolute pattern from an absolute database.

FIG. 12 is a logic diagram showing the database organization and example of FIG. 10 after removing a number of absolute reference patterns according to the processing steps described in the flowchart of FIG. 11;

FIG. 13 is a flow chart showing the processing steps required to remove a rough reference pattern from a rough database for a particular classification family.

FIG. 14 is a logic diagram showing the database organization and example of FIG. 12 after removing a number of general reference patterns according to the processing steps described in the flowchart of FIG. 13;

[Procedure amendment]

[Submission date] April 13, 2000 (2000.4.13)

[Procedure amendment 1]

[Document name to be amended] Drawing

[Correction target item name] All figures

[Correction method] Change

[Correction contents]

[Procedure amendment]

[Submission date] December 7, 2000 (2000.12.7)

[Procedure amendment 1]

[Document name to be amended] Drawing

[Correction target item name] All figures

[Correction method] Change

[Correction contents]

FIG.

FIG. 2

FIG. 3

FIG. 4

FIG. 5

FIG. 6

FIG. 7

FIG. 8

FIG. 9

FIG. 10

FIG. 11

FIG.

FIG. 13

FIG. 14

──────────────────────────────────────────────────続 き Continuation of front page (81) Designated country EP (AT, BE, CH, CY, DE, DK, ES, FI, FR, GB, GR, IE, IT, LU, MC, NL, PT, SE ), OA (BF, BJ, CF, CG, CI, CM, GA, GN, ML, MR, NE, SN, TD, TG), AP (GH, GM, KE, LS, MW, SD, SZ, UG, ZW), EA (AM, AZ, BY, KG, KZ, MD, RU, TJ, TM), AL, AM, AT, AU, AZ, BA, BB, BG, BR, BY, CA, CH, CN, CU, CZ, DE, DK, EE, ES, FI, GB, GE, GH, GM, GW, HU, ID, IL, IS, JP, KE, KG, KP, KR , KZ, LC, LK, LR, LS, LT, LU, LV, MD, MG, MK, MN, MW, MX, NO, NZ, PL, PT, RO, RU, SD, SE, SG, SI, SK, SL, TJ, TM, TR, TT, UA, UG, UZ, VN, YU, ZW (72) Inventor Barnett, Yoram 98105, Washington, USA USA, Seattle, First Avenue Northeast 4515 (72) Inventor Bar, offer One Hundred Twenty-Seventh Avenue AEE 8816 F-term (reference) 98056, Newcastle, Washington 98056, USA 5B089 HB19 KA10 KB06 KC31 5K030 GA11 HA08 HB18 HB20 KA07 LD17 there's a possibility that. When responding to a classification request, the packet classifier (80) first searches the absolute classification database, and then, if necessary, in the appropriate summary pattern database.

Claims (25)

[Claims] 1. A method for classifying network communication packets processed by a plurality of drivers in a network stack, the method comprising the step of storing classification information corresponding to at least one reference pattern in a shared reference pattern database. Searching for the shared reference pattern database, the shared reference pattern database including a reference pattern shared by a number of drivers, and the classification information of the reference pattern logically related to a classification family. Determining a reference pattern that matches the classification pattern created from the network communication packet; and, if the classification pattern matches a stored reference pattern, using the classification information corresponding to the matched reference pattern. Process the network communication packet And B. a method comprising the steps of: 2. The method of claim 1, wherein the stored reference pattern is either a general reference pattern or an absolute reference pattern, and is associated with a classification family, and wherein the shared pattern database includes a classification pattern. An absolute database of all absolute reference patterns irrespective of the family, and for each classification family, a rough database of rough reference patterns related to the classification family are provided. When comparing a classification pattern with a stored reference pattern, A method comprising searching the absolute database of classification patterns, and then, if necessary, searching the summary database associated with a classification family of the classification patterns. 3. The method of claim 2, wherein the absolute database comprises a classification block structure having references to different classification information for a given absolute pattern depending on the classification family. Storing the absolute reference pattern with respect to the stored general reference pattern, further searching the general database for another classification family for the general reference pattern that matches the stored absolute reference pattern; For each, in the classification block, refer to the specific classification family that refers to the classification information of the matched general reference pattern, and in the other classification families, a future classification pattern that indicates that it matches the absolute reference pattern is , Without relying on the summary database, Accordingly, method characterized by consisting of the steps of increasing the search efficiency. 4. The method of claim 2, wherein the absolute database comprises a classification block structure having references to different classification information for a given absolute pattern depending on the classification family. The storage step of storing an absolute reference pattern with respect to each of the installed general reference patterns, and searching the general database, for each match, If the reference to the specific classification family corresponding to the new general reference pattern is null, refer to the classification block for the specific classification family referring to the classification information of the installed general reference pattern, and in the classification family A future classification pattern that indicates a match with the absolute reference pattern Over emissions, without resorting to the general database by matching in the absolute database search, comprising the steps of increasing the search efficiency,
A method comprising: 5. The method of claim 2, wherein the absolute database comprises a classification block structure having references to different classification information for a given absolute pattern depending on the classification family. The storage step of storing an absolute reference pattern with respect to each of the existing outline patterns that match the installed outline reference pattern, and searching the outline database; and For each match having a reference to the particular classification family corresponding to the general reference pattern, searching the general database of the classification family of the installed general reference pattern for the best general reference pattern that matches this absolute pattern. The classification information of the best matched rough reference pattern Referring to a classification block for the specific classification family to be referred to, a future classification pattern indicating that the classification family matches the absolute reference pattern is checked in the absolute database search without relying on the general database. Increasing the search efficiency by means of the method. 6. The method of claim 2, wherein the step of storing a rough reference pattern comprises: generating an entire set of absolute reference patterns corresponding to the rough reference pattern; and each absolute reference of the set of absolute reference patterns. Storing a pattern in an absolute database referencing said classification information given said general reference pattern. 7. The method according to claim 2, wherein each classification pattern to be searched is automatically stored as an absolute pattern in the absolute database to increase the classification efficiency. 8. The method according to claim 2, wherein each classified pattern to be searched is automatically stored as an absolute pattern in the absolute database, and is further removed after a certain period of time, without performing classification on it. A method characterized by increasing the classification efficiency in the future. 9. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 1. 10. A method for classifying packets processed in a network stack, comprising: a software component for combining at least one reference pattern and associated classification information with a reference pattern and corresponding classification information. Installing on a packet classifying means incorporating a database; and presenting the packet classifying means with a classification pattern from a packet to be classified by at least a part of a code from outside the classifying means via a predetermined interface. When the classification pattern matches the installed reference pattern, the classifying unit returns access to the classification information related to the reference pattern to at least a part of the code, and uses the classification information to packet Enabling the processing of: A method comprising: 11. The method of claim 10, wherein at least a portion of the code for presenting the classification pattern via the predefined interface is a software component separate from the packet classification means, A method wherein a software component is made accessible to said packet classification means via said predefined interface. 12. The method of claim 10, wherein at least a portion of the code that presents the classification pattern via the predefined interface is a software driver, wherein a number of software drivers are configured by the predefined software interface. A method comprising making said packet classifying means accessible via an interface. 13. The method according to claim 10, wherein access is provided by returning a pointer to the classification information corresponding to the matched reference pattern. 14. The method of claim 10, further comprising a classification family, wherein at least a portion of the code outside the classification means comprises at least two separate code portions sharing a classification family. A method characterized by the following. 15. The method according to claim 10, wherein said packet classifying means comprises a database storing said installed reference patterns, and determining a match by searching said database to determine said classification patterns. Features method. 16. The method of claim 10, wherein the installed reference pattern is either a general reference pattern or an absolute reference pattern and is associated with a classification family, and wherein the packet classification means includes: Irrespective of the above, an absolute database of all absolute reference patterns and a general database of general reference patterns related to the classification families are provided for each classification family. When the classification patterns are compared with the installed reference patterns, A method for increasing matching efficiency by searching said absolute database of classification patterns and subsequently, if necessary, searching said summary database relating to classification families for said classification patterns. 17. The method of claim 16, wherein the absolute database comprises a classification block structure having references to different classification information for a given absolute pattern depending on the classification family, wherein one classification family has Installing said absolute reference pattern against said general reference pattern further comprising: searching said summary database for another respective classification family for a rough reference pattern that matches said installed absolute reference pattern; In the classification block, referring to the specific classification family referring to the classification information of the matched general reference pattern, the future classification pattern indicating that the other classification family matches the absolute reference pattern, Without relying on the summary database, the absolute database By matching the scan search method characterized by consisting of the steps of increasing the search efficiency. 18. The method of claim 16, wherein the absolute database comprises a classification block structure having references to different classification information for a given absolute pattern depending on the classification family. Installing the general reference pattern for the existing general pattern; further searching the general database for each existing absolute pattern that matches the installed general reference pattern; and If the reference to the specific classification family corresponding to the new general reference pattern is null, refer to the classification block for the specific classification family referring to the classification information of the installed general reference pattern, and Matches the absolute reference pattern at DOO future classification patterns that indicate, without resorting to the general database by matching in the absolute database search, comprising the steps of increasing the search efficiency,
A method comprising: 19. The method of claim 16, wherein the absolute database comprises a classification block structure having references to different classification information for a given absolute pattern depending on the classification family. The installation step of installing a general reference pattern with respect to, further searching the general database for each existing absolute pattern that matches the installed general reference pattern; and For each match having a reference to the particular classification family corresponding to the general schematic reference pattern, searching the general database of the classification family of the installed general reference patterns and finding the best general reference pattern that matches this absolute pattern Find the best matched summary Referencing the classification block for the specific classification family that refers to the classification information of the quasi-pattern, future classification patterns indicating that the classification family matches the absolute reference pattern will be referred to as the absolute classification without relying on the summary database. Increasing the search efficiency by matching in a database search. 20. The method of claim 16, wherein the step of installing a general reference pattern comprises: generating an entire set of absolute reference patterns corresponding to the general reference pattern; and each absolute reference of the absolute reference pattern set. Installing a pattern in an absolute database referencing said classification information given said general reference pattern. 21. The method according to claim 16, wherein each classification pattern presented to said packet classification means is automatically installed as an absolute pattern in said absolute database. 22. The method of claim 16, wherein each classification pattern presented to said packet classification means is automatically installed as an absolute pattern in said absolute database, and further deleted after a certain period of time. A method characterized by not performing classification on. 23. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 10. 24. A method for classifying packets processed in a network stack, the software component installing at least one organized reference pattern and associated classification information in a packet classification means. Organizing the at least one reference pattern and associated classification information into classification families, the packet classification means storing a general reference pattern and corresponding classification information, a database for each classification family; Presenting a classification pattern from a packet to be classified to said classification means via a predetermined interface by a driver, comprising: a common fixed time database storing an absolute reference pattern and corresponding classification information; The classification If the pattern matches an installed reference pattern, returning to the driver access to the classification information associated with the reference pattern and enabling the packet to be processed using the classification information. A method comprising: 25. A computer readable medium having computer executable program code means embodied for classifying packets processed in a network stack based on a classification pattern from individual packets, said computer readable medium comprising: Enableable program code means for interfacing with other parts of the code, receiving a request to install a reference pattern and corresponding classification information into a classification family, receiving a classification pattern classification request from a packet to be classified, and classifying the access means Interface means for returning information, general database means for storing general reference patterns and related classification information when an installation request is received by the interface means for each classification family; In particular, upon receiving an installation request by the installation means, a fixed search time database means for storing an absolute reference pattern and related classification information; and a classification pattern received by the interface means based on the classification request. Compared with the reference pattern stored in the means, if a matching reference pattern is found, return access to the classification information corresponding to the matched reference pattern via the interface means, using the classification information A computer-readable medium comprising: a collation unit configured to process the packet.